Transaction anomaly detection using artificial intelligence techniques

ABSTRACT

Systems and methods for anomaly detection includes accessing first data comprising a plurality of historical reversion transactions. A plurality of legitimate transactions are determined from the plurality of historical reversion transactions. An autoencoder is trained using the plurality of legitimate transactions to generate a trained autoencoder capable of measuring a given transaction for similarity to the plurality of legitimate transactions. A first reconstructed transaction is generated by the trained autoencoder using a first transaction. The first transaction is determined to be anomalous based on a reconstruction difference between the first transaction and the first reconstructed transaction.

BACKGROUND Technical Field

The present disclosure generally relates to machine learning andartificial intelligence technology, and more particularly to transactionanomaly detection, according to various embodiments.

Related Art

In large sets of data, particularly relating to real-world events, asmall sub-set of the data may indicate one or more unusual conditions orunderlying real-world problems that may require remediation. However,such data may be relatively noisy—that is, it can be difficult todistinguish data for an ordinary (e.g. non-problematic) real-world eventversus data for a problematic real-world event that may require that oneor more additional actions be taken. Applicant recognizes that animproved system for detecting data anomalies in transactional data sets,particularly as they relate to real-world events, would be desirable, assuch a detection system can improve computer system security andefficiency.

BRIEF DESCRIPTION OF THE FIGURES

FIG. 1 is a flowchart illustrating a method for anomaly detection inaccordance with an embodiment;

FIG. 2A illustrates a table including combined transaction dataassociated with a user pair including users with different rights inaccordance with an embodiment; FIG. 2B illustrates extracted correlationfeatures of the combined transaction data of FIG. 2A in accordance withan embodiment;

FIG. 3 is a schematic illustrating an anomaly detection system includingan autoencoder for anomaly detection or a portion thereof in accordancewith an embodiment;

FIG. 4 is a schematic illustrating an anomaly detection system or aportion thereof in accordance with an embodiment;

FIG. 5 is a schematic illustrating an anomaly detection system or aportion thereof in accordance with an embodiment;

FIG. 6 is a schematic view illustrating an embodiment of a networkedsystem;

FIG. 7 is a perspective view illustrating an embodiment of a userdevice;

FIG. 8 is a schematic view illustrating an embodiment of a computersystem; and

FIG. 9 is a schematic view illustrating an embodiment of a device thatmay be used as a user device and/or a system provider device.

Embodiments of the present disclosure and their advantages are bestunderstood by referring to the detailed description that follows. Itshould be appreciated that like reference numerals are used to identifylike elements illustrated in one or more of the figures, whereinshowings therein are for purposes of illustrating embodiments of thepresent disclosure and not for purposes of limiting the same.

DETAILED DESCRIPTION

Using machine learning and artificial intelligence technology in anomalydetection systems presents various challenges. For example, training anartificial neural network (ANN) such as an auto-encoder based ANN fordetection of particular events indicated in real-time data may require atraining dataset including a large number of prior events that arelabeled (e.g. indicative of a particular outcome of a past occurrence).Such a training dataset may include noise, e.g., prior events that areincorrectly labeled. Such noise may affect the accuracy of the detectionsystems using neural networks or other artificial intelligencetechniques. Further, the training dataset may include incomplete eventdata which further affects the accuracy of the detection systems.Applicant recognizes that there is a need for improved accuracy andefficiency in detection systems based on real-time events. Accordingly,the present disclosure describes systems and methods for improvedanalytical techniques that relate to transaction anomaly detection invarious embodiments, for example, for electronic payment transactionsconducted through one or more computing devices.

More and more consumers are conducting electronic transactions, such aspurchasing items and services, via computing devices over electronicnetworks such as, for example, the Internet. Consumers routinelypurchase products and services from merchants and individuals alike. Thetransactions may take place directly between a physical or onlinemerchant or retailer and the consumer, and payment is typically made byentering credit card or other funding source information. Transactionsmay also take place with the aid of an online or mobile service providersuch as, for example, PayPal, Inc. of San Jose, Calif. Such serviceproviders can make transactions easier and safer for the partiesinvolved. Purchasing with the assistance of a service provider from theconvenience of virtually anywhere using a mobile device is one mainreason why online and mobile purchases are growing very quickly.

Fraudulent transactions are a major problem with online payment serviceproviders, however. As nefarious entities become more sophisticated,countermeasures for fraud also need to become more sophisticated. Inorder to deal with fraud, a payment service provider may sometimesreverse an electronic payment transaction that was fraudulent (e.g.remove currency from a receiver account and credit it back to a senderaccount), or may otherwise compensate a victim of fraud (e.g. posting anaccount credit). When large numbers of transactions are reversed orotherwise have a mitigating action taken (e.g. to combat fraud, correctfor a merchant who did not deliver an item as promised, etc.), however,a secondary issue arises—the mitigation actions themselves are notalways correct (e.g. it may be the case that a transaction reversal oraccount credit should not have actually been performed, because nounderlying fraud actually occurred, or an underlying fraud was notsufficiently proved for the transaction to have been reversed inaccordance with a payment service provider's terms of service, forexample).

Accordingly, in a transaction system where transactions can be reversedand/or account credits may be issued, it would be desirable to be ableto automatically detect when an incorrect transaction reversal oraccount credit was made. As used herein, the term “reversiontransaction” refers to a transaction that results in a currency credit(or other compensation) being placed into one or more user accounts andthat occurs with respect to another previous transaction (e.g. a buyerpurchase from a seller). Thus, a reversion transaction can include asimple reversal of a prior transaction (seller's account is debited$5.00, purchaser's account is credited $5.00). A reversion transactionmay also include a particular user account being credited withoutanother user account in the previous transaction being debited (e.g. thepayment processing entity, or another entity such as a credit cardissuing bank, may make up the loss, rather than a sender of funds in atransaction). Thus, as used herein, the term “reversion transaction”does not refer to an initial purchase transaction between a buyer andseller (for example, a buyer simply selecting an item at a website inthe course of ordinary shopping, then paying the seller via PayPal™ tocomplete the transaction would not be considered a reversiontransaction).

Various challenges arise in training a neural network system for anomaly(e.g., fraudulent or otherwise incorrect reversion transactions)detection using different types of transaction data. In an example, atransaction may be associated with one or more users each having adifferent right (e.g., transaction initiation right, transactionmodification right, transaction cancellation right, transactionreversion rights, etc.). In that example, transaction data associatedwith a transaction may include user activity data associated with eachof the one or more users. In another example, the transaction data mayinclude data collected at different times (e.g., transactioninitialization time, transaction modification time, and transactioncancellation, etc.) by different devices (e.g., user devices, data lossprevention service provider devices, transaction service providerdevices, other suitable third-party service provider devices, etc.)and/or stored at different databases, which may provide context intodifferent activities of the one or more users. Stated another way,detecting an anomaly event using sophisticated computer machine learningalgorithms can be difficult due to the nature of the underlyingtransactional data.

In various embodiments described below, systems and methods aredescribed to improve the accuracy and efficiency of a neural networksystem for anomaly detection (note that these techniques are applicableto other machine learning models as well, in various embodiments). In aneural network system for anomaly detection (which can include frauddetection on reversion transactions), first data comprising a pluralityof historical reversion transactions is accessed. A plurality oflegitimate transactions are determined from the plurality of historicalreversion transactions. An autoencoder is trained using the plurality oflegitimate transactions to generate a trained autoencoder capable ofmeasuring a given transaction for similarity to the plurality oflegitimate transactions. A first reconstructed transaction is generatedby the trained autoencoder using a first transaction. The firsttransaction is determined to be fraudulent based on a reconstructiondifference between the first transaction and the first reconstructedtransaction. By preprocessing the historical reversion transactions toextract features associated with the autoencoder model, accuracy forfraud detection is improved. Further, by using only the legitimatetransactions for training the autoencoder and using a reconstructiondifference generated by the trained autoencoder directly for anomalydetection, the computational cost is reduced. As such, the performanceof the neural network for anomaly detection is improved. As noted above,in some cases, detection of an anomaly for a reversion transaction mayindicate that the reversion transaction should not have been initiated(e.g. the reversion transaction may be fraud or an error on the part ofthe person who authorized it).

Referring to FIGS. 1, 2A, 2B, 3, 4, and 5, an embodiment of a method 100for providing anomaly detection using a neural network system isillustrated. All or a portion of the operations referred to in FIGS. 1,2A, 2B, 3, 4, 5, and elsewhere herein may be performed in variousembodiments by any suitable computer system including system 800 asdiscussed in FIG. 8. Such a computer system may comprise multipleprocessors and/or server systems in some instances (e.g. a cloud clusteror other computer cluster).

The method may begin at block 102, where a system provider deviceaccesses first data including a plurality of historical transactions. Invarious embodiments, the plurality of historical transactions may beprovided by user devices and third-party service provider devicesthrough a network. The historical transactions may include various typesof historical transactions. In some examples, a historical transactionis an original transaction (e.g., an original purchase transaction, anoriginal payment transaction, etc.). In other examples, a historytransaction is a reversion transaction. Yet in some other examples, ahistorical transaction is a combined historical transaction that mayinclude multiple sub-transactions (e.g., an original purchasetransaction and a reversion transaction) performed by users of differentrights. For example, a combined historical transaction may include asub-transaction (e.g., an original transaction) for payment requested bya first user as a payor, and another sub-transaction (e.g., a reversiontransaction) for refund performed by a second user as an adjuster to thehistorical transaction. At block 102, each of the historicaltransactions may have been labeled (e.g., as a legitimate transaction ora fraud transaction) or have not been labeled.

The method 100 may proceed to block 104, where the plurality ofhistorical transactions are preprocessed to extract features associatedwith a neural network system including an autoencoder model for anomalydetection. In some embodiments, at block 104, an encoding process 106 isperformed. In various embodiments, algorithms for the neural networksystem (e.g., machine learning) accept only numerical inputs, andtherefore categorical variables of the historical transactions areencoded into numerical values using encoding techniques. Variousencoding techniques, including for example, one hot encoding, ordinalencoding, sum encoding, Helmert encoding, polynomial encoding, backwarddifference encoding, binary encoding, any other suitable encodingtechniques, and/or a combination thereof, may be used.

In some examples, at block 104, a conversion process 108 is performed.For example, a combined historical transaction for payment may include afirst sub-transaction of an initial transaction for payment performed ata first date (e.g., May 1, 2018), and a second sub-transaction of areversion transaction performed at a second date (e.g., Jun. 1, 2018).The conversion process 108 may convert the first date into a difference(e.g., 1 month) between the first date and the second date, which may bereferred to as an extracted feature of a refund time period for thatcombined historical transaction.

Referring to FIGS. 2A and 2B, in some embodiments, at block 104, acombination process 110 is performed to combine associated historicaltransactions (e.g., an initial transaction and a reversion transactionperformed by different users of different rights) to generate a combinedhistorical transaction. Those associated historical transactions may bereferred to as sub-transactions of the combined historical transaction.In some examples, the combination process 110 may also determine userinformation (e.g., name, past and current home/work addresses, birthdate, education, employment experiences, relatives, social mediaaccount, etc.) of corresponding different users (e.g., payor, adjustor)of the sub-transactions, and generate the combined historicaltransaction including the user information of the different users of thesub-transactions.

The combination process 110 may extract features (e.g., correlationfeatures associated with correlations of the sub-transactions)associated with the autoencoder for anomaly detection. Referring to theexample of FIG. 2A, a combined historical transaction 218 is generatedby combining a sub-transaction of an initial transaction performed by afirst user (payor) 202 that has a transaction type 210 of “Payment” withan amount 212 of “$30,” and a sub-transaction of a reversion transactionperformed by a second user (adjuster) 204 that has a transaction type214 of “Refund” with an amount 216 of “$30.” Similarly, a combinedhistorical transaction 220 is generated by combining a sub-transactionof an initial transaction performed by a first user (payor) 202 that hasa transaction type 210 of “Payment” with an amount 212 of “$70,” and asub-transaction of a reversion transaction performed by a second user(adjuster) 204 that has a transaction type 214 of “Refund” with anamount 216 of “$40.” (A Refund transaction may be reversion transaction,for example, while the “Payment” type of transaction in this example isnot a reversion transaction.)

Referring to the example of FIG. 2B, the correlation features extractedfrom the combined historical transactions 218 and 220 are illustrated.As shown in FIG. 2B, the correction feature table 250 includescorrection features 252 (e.g., “Total Refund Times,” “RelationshipPeriod,” “Total Refund Amount,” “Refund Frequency”) with correspondingvalues 254 respectively (e.g., “2,” “8 months,” “$70,” and “0.25times/month”). These correction features may be used as featuresassociated with anomaly detection by the autoencoder model.

Various correlation features 252 that are not illustrated in FIG. 2B maybe extracted based on the autoencoder model for anomaly detection. In anexample, a correlation feature may include a home address distancebetween the first user 202 and second user 204, using home addresses ofthose users provided by the combined historical transactions. In anotherexample, a correlation feature may include a transaction locationdistance between the first user 202 and second user 204 when thesub-transactions were performed, using transaction locations provided bythe combined historical transactions. In yet another example, acorrelation feature may include a social media interaction frequency(e.g., six comments each week between two corresponding social mediaaccounts), using social media accounts of those users provided by thecombined historical transaction. Any other correlation features suitablefor the autoencoder model for anomaly detection may be used.

The method 100 may proceed to block 112, where a plurality of legitimatetransactions are determined (e.g., by an operator, by a system providerdevice automatically based on legitimate transaction rules, etc.). Thelegitimate transaction rules may be used to determine that a transactionis legitimate based on one or more of properties of the transaction dataand/or extracted features. In some examples, the legitimate transactionrules include a transaction age rule providing that an initialtransaction that was initiated a predetermined period ago (e.g., 3months or 6 months) and does not have a corresponding reversiontransaction is legitimate. In an example, such a legitimate transactionrule is determined based on a refund eligibility period (e.g., 6months). Because no refund may be provided to an initial transactionwith an age of 6 months, that initial transaction became final andthereby is determined to be legitimate. Human review and designation canalso be a legitimate transaction rule in various embodiments (e.g. ahuman reviewer marking a transaction as legitimate).

In some examples, the legitimate transaction rules are based on a trustlevel of a user of a transaction. For example, a legitimate transactionrule may provide that a reversion transaction by a user (adjuster) witha particular trust level (e.g., high) is legitimate. In some examples, alegitimate transaction rule is based on a reversion amount percentage(e.g., reversion amount/initial transaction amount). For example, alegitimate transaction rule may provide that a reversion transaction islegitimate if the refund amount percentage is less than a predeterminedthreshold (e.g., 0.0001).

The method 100 may proceed to block 114, where the autoencoder model istrained using the legitimate transactions with the extracted features togenerate a trained autoencoder model. Referring to the example of FIG.3, an autoencoder 300 of a neural network system for anomaly detectionis illustrated, according to some embodiments. The autoencoder 300includes an encoder 302 and a decoder 304, each of the encoder 302 anddecoder 304 may be implemented using a neural network model.

The autoencoder 300 may learn to compress an input data x_(i) 310 (e.g.,a legitimate transaction 310) into a latent variable (also referred toas a latent code or a latent representation), denoted as En(x_(i)) in alatent space 306. In an example, the input transaction 310 may have Nattributes (e.g., transaction time, transaction type, payor, payee,transaction history, adjuster, age, refund amount, refund frequency,etc.), and as such, is in an N-dimensional space. The latent space 306may have M dimensions, where M is less than N. The decoder 304 mayuncompress that latent representation En(x_(i)) into a reconstructeddata 314 (denoted as De(En(x_(i)))) that closely matches the input datax_(i) 310. As such, the autoencoder 300 engages in dimensionalityreduction, for example by learning how to ignore the noise. Areconstruction loss function may be used by the loss computation unit308 of the autoencoder 300 to generate a reconstruction error 312. Anexemplary reconstruction loss function is provided as follows:

$L_{reconstruction} = {\frac{1}{n}{\sum\limits_{i = 1}^{n}{{{x_{i} - {{De}\left( {{En}\left( x_{i} \right)} \right)}}}.}}}$

The autoencoder 300 may be trained (e.g., using backpropagation andgradient descent) to minimize the reconstruction loss function. In oneexample, the goal of the training process is to learn the identityfunction of the training dataset with the minimum reconstruction error.Thus, the autoencoder is configured to learn how to reconstruct trainingdata as best as possible. In some embodiments, by training theautoencoder with only the legitimate transactions determined based onlegitimate transaction rules and not using all of the historicaltransactions, the computation time for the training process is reduced.

In various embodiments, the autoencoder 300 is specifically trained torecognize whether a particular reversion transaction (e.g., in view ofanother reference transaction which is not a reversion transaction)appears to be anomalous—that is, if its characteristic data and otherrelated data seems to be sufficiently far away from known good data ofother reversion transactions. Data that can be examined and used tobuild autoencoder 300 can include provider entity ID+customer ID pairs(e.g. unique identifier for an authorized user of a payment provider whocan issue a reversion transaction and an ID for a customer who does nothave such power). Additional feature data relating to a provider entityID/customer ID for a reversion transaction may also be used—e.g. howmany reversion transactions have occurred between a given ID pair; howlong a relationship was between a first reversion transaction and alater reversion transaction using the same provider entity ID/customerID. It may be anomalous, for example, if a same provider entity ID wasused to issue four different reversions to the same customer within amonth, but using a rules based approach (rather than an autoencoder)might generate many false positives if it was simply based on one factorlike this.

In various embodiments, various features extracted at process 110 may beused by the autoencoder 300 during the training. The features mayinclude any and all transaction data, including e.g., transaction time(date, time of day, etc.), a transaction amount, user's averagetransaction amount, reversion frequency, any suitable features, and/or acombination thereof. In an example, the autoencoder may be trained tolearn that while a particular reversion transaction frequency by thesame adjustor to the same payor (e.g., four reversion transactions in amonth) with a lower transaction amount (e.g., less than $1,000) isassociated with a moderate likelihood of fraud (e.g., 40% likelihood),that particular reversion transaction frequency with a highertransaction amount (e.g., greater than $5,000) is associated with a highlikelihood of fraud. In another example, the autoencoder may be trainedto learn that a higher refund amount percentage (e.g., total refundamount/total transaction amount) corresponds to a higher likelihood offraud. In an example, a first historical transaction has a higher refundamount percentage (e.g., 1000/160) where the customer receives refunds(e.g., $100, $200, $300, and $400) for four transactions (e.g., withtransaction amounts of $ 20, $ 30, $ 50, and $ 60), and a secondtransaction has a lower refund amount percentage (e.g., 22/160) (e.g., $4, $ 5, $ 6, and $ 7) refund for four transactions (e.g., withtransaction amounts of $ 20, $ 30, $ 50, and $ 60). The autoencoder maybe trained to learn that the first transaction has a higher likelihoodof fraud than the second transaction. In another example, theautoencoder may be trained to use various features (e.g., transactionlocations, country of sellers, physical location of entity ID/customerID) in determining the likelihood of fraud.

The method 100 may then proceed to block 116, where a reconstructiondifference threshold for anomaly is determined. In the descriptionbelow, fraud detection is used as an example, and the reconstructiondifference threshold for anomaly is also referred to as a reconstructiondifference threshold for fraud. In some embodiments, the reconstructiondifference threshold for fraud is provided by an operator or retrievedfrom a storage device. Alternatively, as shown in the example of FIG. 4,a reconstruction difference threshold for fraud may be determined usingthe trained autoencoder 300. As shown in FIG. 4, the trained autoencoder300 receives a plurality of fraudulent transaction data 402 ofhistorical transactions (e.g., initial transactions, reversiontransactions, combined historical transactions, and/or a combinationthereof) that have been labeled as fraudulent. The trained autoencodergenerates a reconstruction difference 404 for each fraudulenttransaction 402.

The reconstruction error threshold for fraud generator 406 receives theplurality of reconstruction difference 404 for fraudulent transactions,and determines a reconstruction error threshold for fraud 408 (e.g., anaverage of the reconstruction differences 404, a weighted average of thereconstruction differences 404 using weights corresponding to theconfidence level of the labeling, etc.).

The method 100 may then proceed to block 118, where a first transactionfor anomaly detection is received. Referring to the example of FIG. 5,an anomaly detection system 500 is illustrated. An anomaly detectionsystem provider device 504 may receive a first transaction 510 from athird-party service provider device 502. The first transaction 510 isnot in the historical transactions accessed at block 102. The firsttransaction 510 may be an initial transaction, a reversion transaction,or a combined transaction including sub-transactions (e.g., initialpayment transaction, reversion transaction) performed at different timesand locations, using different devices, and/or by different users. Insome examples, a preprocessing process substantially similar to block104 may be performed by a preprocessor 512 to the first transaction 510,such that the preprocessed first transaction includes extracted featuresassociated with the trained autoencoder model 300

The method 100 may then proceed to block 120, where an inference processis performed on the trained autoencoder 300 to generate a firstreconstructed transaction for the first transaction 510. The trainedautoencoder 300 may (e.g., using its loss computation unit 308) comparethe first reconstructed transaction and the first transaction 510, andgenerate a reconstruction difference 514.

The method 100 may then proceed to block 122, where the system providerdevice determines whether the first transaction 510 is fraudulent basedon reconstruction difference 514. In various embodiments, because thetrained autoencoder 300 has been trained using legitimate transactions,the reconstruction difference 514 may be used to determine whether thefirst instruction is fraudulent (e.g., with a large reconstructiondifference 514) or legitimate (e.g., with a small reconstructiondifference 514). In the example of FIG. 5, an anomaly detector 506receives the reconstruction error threshold for fraud 408 (e.g., fromreconstruction error threshold for fraud generator 406) and thereconstruction difference 514 (e.g., from the trained autoencoder 300),and generates a fraud prediction 516 (e.g., a binary value, aprobability, etc.) indicating the likelihood that the first transaction510 is fraudulent.

The method 100 may proceed to block 124, various actions may beperformed after it is determined that the first transaction 510 isfraudulent. In an example, a remediation action is performedautomatically to the first transaction. In another example, a fraudulenttransaction alert may be provided to an operator.

It is noted that while anomaly detection for online transactions (e.g.,a payment transaction, transactions for taking an online course, playingcomputer games, viewing digital content such as news/blogs, shopping)are used as examples for using a neural network system to detect fraud,the method 100 and systems described may be used to improve accuracy andefficiency of the neural network system (e.g., by addressing noisy labelproblems) for any suitable applications of neural network systems. Forexample, the described systems and methods may be used in applicationsfor image processing, computer vision, natural language processing,autonomous driving, etc.

Referring now to FIG. 6, an embodiment of a network-based system 600 forimplementing one or more processes described herein is illustrated. Asshown, network-based system 600 may comprise or implement a plurality ofservers and/or software components that operate to perform variousmethodologies in accordance with the described embodiments. Exemplaryservers may include, for example, stand-alone and enterprise-classservers operating a server OS such as a MICROSOFT® OS, a UNIX® OS, aLINUX® OS, or other suitable server-based OS. It can be appreciated thatthe servers illustrated in FIG. 6 may be deployed in other ways and thatthe operations performed and/or the services provided by such serversmay be combined or separated for a given implementation and may beperformed by a greater number or fewer number of servers. One or moreservers may be operated and/or maintained by the same or differententities.

The embodiment of the networked system 600 illustrated in FIG. 6includes one or more user devices 602, one or more system providerdevices 606, and one or more third-party service provider devices 604 incommunication over a network 610. Any of the user devices 602 may be auser device associated with a transaction with a third-party serviceprovider device or a system provider device discussed above. The systemprovider device 606 may implement the neural network system for anomalydetection (e.g., fraud detection), and may be operated by a systemprovider such as, for example, PayPal Inc. of San Jose, Calif. Thethird-party service provider device 604 may be the service providerdevice providing transaction services with the user device 602 and maybe operated by various service providers including payment serviceproviders, discount providers, marketplace providers, and/or any otherservice providers.

The user devices 602, system provider devices 606, and third-partyservice provider devices 604 may each include one or more processors,memories, and other appropriate components for executing instructionssuch as program code and/or data stored on one or more computer readablemediums to implement the various applications, data, and steps describedherein. For example, such instructions may be stored in one or morecomputer-readable mediums such as memories or data storage devicesinternal and/or external to various components of the system 600, and/oraccessible over the network 610.

The network 610 may be implemented as a single network or a combinationof multiple networks. For example, in various embodiments, the network610 may include the Internet and/or one or more intranets, landlinenetworks, wireless networks, and/or other appropriate types of networks.

The user device 602 may be implemented using any appropriate combinationof hardware and/or software configured for wired and/or wirelesscommunication over network 610. For example, in one embodiment, the userdevice 602 may be implemented as a personal computer of a user incommunication with the Internet. In some embodiments, the user device602 may be a wearable device. In some embodiments, the user device 602may be a smartphone, personal digital assistant (PDA), laptop computer,and/or other types of computing devices.

The user device 602 may include one or more browser applications whichmay be used, for example, to provide a convenient interface to permitthe customer to browse information available over the network 610. Forexample, in one embodiment, the browser application may be implementedas a web browser configured to view information available over theInternet.

The user device 602 may also include one or more toolbar applicationswhich may be used, for example, to provide user-side processing forperforming desired tasks in response to operations selected by thecustomer. In one embodiment, the toolbar application may display a userinterface in connection with the browser application.

The user device 602 may further include other applications as may bedesired in particular embodiments to provide desired features to theuser device 602. In particular, the other applications may include anonline payment transaction application provided by an online paymenttransaction provider. The other applications may also include securityapplications for implementing user-side security features, programmaticuser applications for interfacing with appropriate applicationprogramming interfaces (APIs) over the network 610, or other types ofapplications. Email and/or text applications may also be included, whichallow the customer to send and receive emails and/or text messagesthrough the network 610. The user device 602 includes one or more userand/or device identifiers which may be implemented, for example, asoperating system registry entries, cookies associated with the browserapplication, identifiers associated with hardware of the user device602, or other appropriate identifiers, such as a phone number. In oneembodiment, the user identifier may be used by the system providerdevice 606, and/or the third-party service provider device 604 associatethe user with a particular account as further described herein.

Referring now to FIG. 7, an embodiment of a user device 700 isillustrated. The user device 700 may be the user devices 602. The userdevice 700 includes a chassis 702 having a display 704 and an inputdevice including the display 704 and a plurality of input buttons 706.One of skill in the art will recognize that the user device 700 is aportable or mobile phone including a touch screen input device and aplurality of input buttons that allow the functionality discussed abovewith reference to the method 100. However, a variety of otherportable/mobile customer devices may be used in method 100 withoutdeparting from the scope of the present disclosure.

Referring now to FIG. 8, an embodiment of a computer system 800 suitablefor implementing, for example, user device 602, system provider device606, and/or third-party service provider device 604 is illustrated. Itshould be appreciated that other devices utilized by users, systemproviders, third-party user information providers, third party serviceproviders, and/or system providers in the system discussed above may beimplemented as the computer system 800 in a manner as follows.

In accordance with various embodiments of the present disclosure,computer system 800, such as a computer and/or a network server,includes a bus 802 or other communication mechanism for communicatinginformation, which interconnects subsystems and components, such as aprocessing component 804 (e.g., processor, micro-controller, digitalsignal processor (DSP), etc.), a system memory component 806 (e.g.,RAM), a static storage component 808 (e.g., ROM), a disk drive component1210 (e.g., magnetic or optical), a network interface component 1212(e.g., modem or Ethernet card), a display component 1214 (e.g., CRT orLCD), an input component 1218 (e.g., keyboard, keypad, or virtualkeyboard), a cursor control component 1220 (e.g., mouse, pointer, ortrackball), and a location sensor component 1222 (e.g., a GlobalPositioning System (GPS) device as illustrated, a cell towertriangulation device, and/or a variety of other location determinationdevices known in the art). In one implementation, the disk drivecomponent 1210 may comprise a database having one or more disk drivecomponents.

In accordance with embodiments of the present disclosure, the computersystem 800 performs specific operations by the processor 804 executingone or more sequences of instructions contained in the memory component806, such as described herein with respect to the user devices 602,service provider device 606, and/or third-party service provider device604. Such instructions may be read into the system memory component 806from another computer-readable medium, such as the static storagecomponent 808 or the disk drive component 810. In other embodiments,hard-wired circuitry may be used in place of or in combination withsoftware instructions to implement the present disclosure.

Logic may be encoded in a computer readable medium, which may refer toany medium that participates in providing instructions to the processor804 for execution. Such a medium may take many forms, including but notlimited to, non-volatile media, volatile media, and transmission media.In one embodiment, the computer readable medium is non-transitory. Invarious implementations, non-volatile media includes optical or magneticdisks, such as the disk drive component 810, volatile media includesdynamic memory, such as the system memory component 806, andtransmission media includes coaxial cables, copper wire, and fiberoptics, including wires that comprise the bus 802. In one example,transmission media may take the form of acoustic or light waves, such asthose generated during radio wave and infrared data communications.

Some common forms of computer readable media includes, for example,floppy disk, flexible disk, hard disk, magnetic tape, any other magneticmedium, CD-ROM, any other optical medium, punch cards, paper tape, anyother physical medium with patterns of holes, RAM, PROM, EPROM,FLASH-EPROM, any other memory chip or cartridge, carrier wave, or anyother medium from which a computer is adapted to read. In oneembodiment, the computer readable media is non-transitory.

In various embodiments of the present disclosure, execution ofinstruction sequences to practice the present disclosure may beperformed by the computer system 800. In various other embodiments ofthe present disclosure, a plurality of the computer systems 800 coupledby a communication link 824 to the network 610 (e.g., such as a LAN,WLAN, PTSN, and/or various other wired or wireless networks, includingtelecommunications, mobile, and cellular phone networks) may performinstruction sequences to practice the present disclosure in coordinationwith one another.

The computer system 800 may transmit and receive messages, data,information and instructions, including one or more programs (i.e.,application code) through the communication link 824 and the networkinterface component 812. The network interface component 812 may includean antenna, either separate or integrated, to enable transmission andreception via the communication link 824. Received program code may beexecuted by processor 804 as received and/or stored in disk drivecomponent 810 or some other non-volatile storage component forexecution.

Referring now to FIG. 9, an embodiment of a device 900 is illustrated.In an embodiment, the device 900 may be a system provider device 606discussed above. The device 900 includes a communication engine 902 thatis coupled to the network 610 and to an anomaly detection engine 904that is coupled to a historical transaction database 906 (e.g.,providing historical transactions including historical reversiontransactions) and a legitimate transaction rule database 908. Thecommunication engine 902 may be software or instructions stored on acomputer-readable medium that allows the device 900 to send and receiveinformation over the network 610. The anomaly detection engine 904 maybe software or instructions stored on a computer-readable medium that isoperable to perform operations including accessing first data comprisinga plurality of historical reversion transactions; determining aplurality of legitimate transactions from the plurality of historicalreversion transactions; training an autoencoder using the plurality oflegitimate transactions to generate a trained autoencoder capable ofmeasuring a given transaction for similarity to the plurality oflegitimate transactions; generating, by the trained autoencoder, a firstreconstructed transaction using a first transaction; and determiningthat the first transaction is fraudulent based on a reconstructiondifference between the first transaction and the first reconstructedtransaction. The operations may also provide any of the otherfunctionality that is discussed above. While the databases 906-908 havebeen illustrated as separate from each other and located in the device900, one of skill in the art will recognize that any or all of thedatabases 906-908 may be combined and/or may be connected to the anomalydetection engine 904 through the network 610 without departing from thescope of the present disclosure.

Where applicable, various embodiments provided by the present disclosuremay be implemented using hardware, software, or combinations of hardwareand software. Also, where applicable, the various hardware componentsand/or software components set forth herein may be combined intocomposite components comprising software, hardware, and/or both withoutdeparting from the scope of the present disclosure. Where applicable,the various hardware components and/or software components set forthherein may be separated into sub-components comprising software,hardware, or both without departing from the scope of the presentdisclosure. In addition, where applicable, it is contemplated thatsoftware components may be implemented as hardware components andvice-versa.

Software, in accordance with the present disclosure, such as programcode and/or data, may be stored on one or more computer-readablemediums. It is also contemplated that software identified herein may beimplemented using one or more general purpose or specific purposecomputers and/or computer systems, networked and/or otherwise. Whereapplicable, the ordering of various steps described herein may bechanged, combined into composite steps, and/or separated into sub-stepsto provide features described herein.

The foregoing disclosure is not intended to limit the present disclosureto the precise forms or particular fields of use disclosed. As such, itis contemplated that various alternate embodiments and/or modificationsto the present disclosure, whether explicitly described or impliedherein, are possible in light of the disclosure. Having thus describedembodiments of the present disclosure, persons of ordinary skill in theart will recognize that changes may be made in form and detail withoutdeparting from the scope of the present disclosure. Thus, the presentdisclosure is limited only by the claims.

The foregoing disclosure is not intended to limit the present disclosureto the precise forms or particular fields of use disclosed. As such, itis contemplated that various alternate embodiments and/or modificationsto the present disclosure, whether explicitly described or impliedherein, are possible in light of the disclosure. Having thus describedembodiments of the present disclosure, persons of ordinary skill in theart will recognize that changes may be made in form and detail withoutdeparting from the scope of the present disclosure. Thus, the presentdisclosure is limited only by the claims.

What is claimed is:
 1. A system, comprising: a non-transitory memory;and one or more hardware processors coupled to the non-transitory memoryand configured to read instructions from the non-transitory memory tocause the system to perform operations comprising: accessing first datacomprising a plurality of historical reversion transactions; determininga plurality of legitimate reversion transactions from the plurality ofhistorical reversion transactions; training an autoencoder using theplurality of legitimate reversion transactions to generate a trainedautoencoder capable of measuring a given reversion transaction forsimilarity to the plurality of legitimate reversion transactions;generating, by the trained autoencoder, a first reconstructed reversiontransaction using a first reversion transaction not included in theplurality of historical reversion transactions; and determining that thefirst reversion transaction is anomalous based on a reconstructiondifference between the first reversion transaction and the firstreconstructed reversion transaction.
 2. The system of claim 1, whereinthe autoencoder is a denoising autoencoder, and wherein the training thedenoising autoencoder includes: generating a corrupted training data ofan original training data by adding noise to the original training data;and generating a reconstructed data of the original training data basedon the corrupted training data.
 3. The system of claim 1, wherein theplurality of legitimate transactions from the plurality of historicaltransactions are determined based on one or more legitimate transactionrules.
 4. The system of claim 3, wherein the one or more legitimatetransaction rules include a transaction user trust level rule fordetermining that a historical reversion transaction is legitimate basedon a trust level of a user performed the historical reversiontransaction.
 5. The system of claim 1, wherein the operations include:determining a plurality of anomalous transactions from the plurality ofhistorical reversion transactions; generating, using the trainedautoencoder based on the plurality of anomalous transactions, areconstruction error threshold for anomaly; and determining that thefirst reversion transaction is anomalous by comparing the reconstructiondifference with the reconstruction error threshold for anomaly.
 6. Thesystem of claim 1, wherein the autoencoder includes an encoder and adecoder, wherein a trained encoder of the trained autoencoder isconfigured to receive the first transaction in an N-dimensional dataspace and generate a latent variable in an M-dimensional latent space,wherein M is an integer less than N, and wherein a trained decoder ofthe trained autoencoder is configured to generate the firstreconstructed transaction using the latent variable.
 7. The system ofclaim 1, wherein the operations further comprise: preprocessing theplurality of historical reversion transactions to generate a pluralityof preprocessed transactions including extracted features for theautoencoder; wherein the plurality of legitimate reversion transactionsfor training the autoencoder include the preprocessed transactions.
 8. Amethod, comprising: providing a plurality of legitimate reversiontransactions; training an autoencoder using the plurality of legitimatereversion transactions to generate a trained autoencoder capable ofmeasuring a given reversion transaction for similarity to the pluralityof legitimate reversion transactions; generating, by the trainedautoencoder, a first reconstructed reversion transaction using a firstreversion transaction not included in the plurality of historicalreversion transactions; and determining that the first reversiontransaction is anomalous based on a reconstruction difference betweenthe first reversion transaction and the first reconstructed reversiontransaction.
 9. The method of claim 8, wherein the autoencoder is adenoising autoencoder, and wherein the training the denoisingautoencoder includes: generating a corrupted training data of anoriginal training data by adding noise to the original training data;and generating a reconstructed data of the original training data basedon the corrupted training data.
 10. The method of claim 8, wherein theplurality of legitimate reversion transactions are determined based onone or more legitimate transaction rules.
 11. The method of claim 8,wherein the one or more legitimate transaction rules include alegitimate transaction rule based on a reversion amount percentage basedon a reversion amount over an initial transaction amount associated withthe historical reversion transactions.
 12. The method of claim 8,wherein the autoencoder includes an encoder and a decoder, wherein atrained encoder of the trained autoencoder is configured to receive thefirst transaction in an N-dimensional data space and generate a latentvariable in an M-dimensional latent space, wherein M is an integer lessthan N, and wherein a trained decoder of the trained autoencoder isconfigured to generate the first reconstructed transaction using thelatent variable.
 13. The method of claim 8, wherein the training theautoencoder includes: preprocessing the plurality of historicalreversion transactions to generate a plurality of preprocessedtransactions including extracted features for the autoencoder; whereinthe plurality of legitimate reversion transactions for training theautoencoder include the preprocessed transactions.
 14. The method ofclaim 13, wherein the extracted features include one or more correlationfeatures associated with a first user performed an initial transactionassociated with a historical reversion transaction and a second userperformed the historical reversion transaction.
 15. A non-transitorymachine-readable medium having stored thereon machine-readableinstructions executable to cause a machine to perform operationscomprising: accessing first data comprising a plurality of historicalreversion transactions including a plurality of legitimate reversiontransactions and a plurality of anomalous reversion transactions;training an autoencoder using the plurality of legitimate reversiontransactions to generate a trained autoencoder without using theplurality of anomalous reversion transactions; generating, by thetrained autoencoder, a first reconstructed transaction using a firstreversion transaction; and determining that the first reversiontransaction is anomalous based on a reconstruction difference betweenthe first reversion transaction and the first reconstructed transaction.16. The non-transitory machine-readable medium of claim 15, wherein theoperations further comprise: determining that the first reversiontransaction is anomalous by comparing the reconstruction difference witha reconstruction error threshold for anomaly.
 17. The non-transitorymachine-readable medium of claim 16, wherein the operations furthercomprise: generating, using the trained autoencoder based on theplurality of anomalous reversion transactions, the reconstruction errorthreshold for anomaly.
 18. The non-transitory machine-readable medium ofclaim 15, wherein the training the autoencoder includes: preprocessingthe plurality of historical reversion transactions to generate aplurality of preprocessed transactions including extracted features forthe autoencoder.
 19. The non-transitory machine-readable medium of claim15, wherein the plurality of legitimate reversion transactions fortraining the autoencoder are determined using the preprocessedtransactions.
 20. The non-transitory machine-readable medium of claim19, wherein the preprocessing the plurality of historical reversiontransactions includes: combining a first sub-transaction including aninitial transaction performed by a first user and a secondsub-transaction including a reversion transaction performed by a seconduser to generate a combined historical reversion transaction; andextracting features of the combined historical reversion transaction togenerate a preprocessed combined historical reversion transaction.